CVE-2026-118676: n8n credential permission bypass

CISO Take

CVE-2026-118676 is an authorization flaw in n8n, the workflow automation platform widely used to wire AI agents to internal systems. A low-privileged member can omit default node parameters so the pre-execution credential checks skip the credential slots. The workflow then runs with credentials the member was never granted, and the decrypted values can be sent to a destination the attacker chooses. The CVSS of 7.1 is held down by high attack complexity, but the changed scope and high confidentiality impact matter because n8n credentials often include LLM API keys, database logins and SaaS tokens. There is no CISA KEV listing, no public exploit and no Nuclei template, and EPSS data is not available, so this is not known to be exploited. Because exploitation needs only an authenticated member account, treat it as an insider and compromised-account risk. Upgrade to 1.123.85, 2.43.5 or 2.44.1 or later, then review which members can create workflows and rotate any credentials they might have reached.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High. The CVSS is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N). The attacker needs a valid low-privilege member account, and the high complexity limits opportunistic abuse. Impact is confined to confidentiality in practice, but the scope change means the stolen secrets give access well beyond n8n. Exploitation likelihood is moderate. There is no KEV entry, no public exploit and no scanner template, and EPSS is unavailable. Multi-user n8n instances with many members, shared credentials and outbound internet access are the most exposed. Single-user instances are largely unaffected.

How does the attack unfold?

Initial Access

Attacker signs in with a low-privilege member account on a shared n8n instance.

AML.T0012

Exploitation

Attacker saves and runs a workflow that omits default node parameters, so the credential permission check is skipped.

AML.T0106

Credential Access

The workflow runs with a credential the attacker cannot access, and n8n decrypts it at runtime.

AML.T0098

Exfiltration

Decrypted secrets are sent to an attacker-controlled endpoint, enabling LLM API abuse and access to connected systems.

AML.T0025

Initial Access

Attacker signs in with a low-privilege member account on a shared n8n instance.

AML.T0012

Exploitation

Attacker saves and runs a workflow that omits default node parameters, so the credential permission check is skipped.

AML.T0106

Credential Access

The workflow runs with a credential the attacker cannot access, and n8n decrypts it at runtime.

AML.T0098

Exfiltration

Decrypted secrets are sent to an attacker-controlled endpoint, enabling LLM API abuse and access to connected systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict the member role, remove workflow create and edit rights from untrusted users, and limit credential sharing to the people who need it. 3) Restrict outbound traffic from the n8n host with an egress allowlist, which limits where decrypted values can be sent, and block the HTTP Request node where it is not needed. 4) Audit workflow history for recent workflows created or modified by members, especially ones using nodes with credentials the author did not own or with parameters left at their defaults. 5) Review egress and proxy logs for unexpected destinations contacted from n8n. 6) Rotate credentials that were exposed to untrusted members, giving priority to LLM API keys, cloud keys and database passwords. 7) Apply least-privilege scopes to the credentials stored in n8n.

How is it classified?

Auth BypassData LeakageData ExtractionAgentFrameworkPluginAML.T0012- Valid Accounts AML.T0025- Exfiltration via Cyber Means AML.T0098- AI Agent Tool Credential Harvesting AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and treat them

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118676?

CVE-2026-118676 is an authorization flaw in n8n, the workflow automation platform widely used to wire AI agents to internal systems. A low-privileged member can omit default node parameters so the pre-execution credential checks skip the credential slots. The workflow then runs with credentials the member was never granted, and the decrypted values can be sent to a destination the attacker chooses. The CVSS of 7.1 is held down by high attack complexity, but the changed scope and high confidentiality impact matter because n8n credentials often include LLM API keys, database logins and SaaS tokens. There is no CISA KEV listing, no public exploit and no Nuclei template, and EPSS data is not available, so this is not known to be exploited. Because exploitation needs only an authenticated member account, treat it as an insider and compromised-account risk. Upgrade to 1.123.85, 2.43.5 or 2.44.1 or later, then review which members can create workflows and rotate any credentials they might have reached.

Is CVE-2026-118676 actively exploited?

No confirmed active exploitation of CVE-2026-118676 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118676?

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict the member role, remove workflow create and edit rights from untrusted users, and limit credential sharing to the people who need it. 3) Restrict outbound traffic from the n8n host with an egress allowlist, which limits where decrypted values can be sent, and block the HTTP Request node where it is not needed. 4) Audit workflow history for recent workflows created or modified by members, especially ones using nodes with credentials the author did not own or with parameters left at their defaults. 5) Review egress and proxy logs for unexpected destinations contacted from n8n. 6) Rotate credentials that were exposed to untrusted members, giving priority to LLM API keys, cloud keys and database passwords. 7) Apply least-privilege scopes to the credentials stored in n8n.

What systems are affected by CVE-2026-118676?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-118676?

CVE-2026-118676 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelinesmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0025Exfiltration via Cyber Means

AML.T0098AI Agent Tool Credential Harvesting

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.

Exploitation Scenario

An attacker holds a member account on a company's shared n8n instance, obtained through a malicious insider, phishing or a compromised SSO session. They find the ID of a credential they cannot access, such as the production LLM API key or CRM token used by an AI agent workflow. They build a workflow that uses that credential but leaves out the default node parameters, so the pre-execution permission check skips the credential slot. The workflow also includes a node that posts data to a server they control. When it runs, the decrypted credential is sent to that server. The attacker then uses the key to run up LLM usage, read data from connected systems, or pivot further into the environment.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.